Exploited MongoBleed flaw leaks MongoDB secrets, 87K servers exposed

A critical MongoDB vulnerability named MongoBleed (CVE-2025-14847) allows unauthenticated attackers to trigger zlib-based decompression memory leaks and exfiltrate in-memory secrets (credentials, API/cloud keys, tokens, PII). A public PoC is available and active exploitation has been observed; Censys found ~87,000 potentially vulnerable instances and cloud telemetry shows widespread exposure. MongoDB released patches and recommends updating (or disabling zlib) while detection tools and log parsers have been published to hunt for exploitation.